Privacy Policy

1. Who we are

This Privacy Policy explains how TrinityHawk collects, uses and protects personal data when you visit our website at trinityhawk.com (the “Site”), contact us, or engage us for services.

The data controller is TrinityHawk Ltd (“TrinityHawk”, “we”, “us” or “our”), a company registered in England and Wales under company number 15048603, with its registered office at 124 City Road, London, EC1V 2NX.

TrinityHawk operates as a single international firm. Where services are delivered in Iceland, the controller may be TrinityHawk ehf (kennitala 4306251360), Selbrekku 24, 200 Kópavogur, Iceland. A United States entity is also available for United States engagements. The relevant controlling entity for a given engagement is confirmed in the applicable services agreement.

For any question about this policy or your personal data, contact us at info@trinityhawk.com or write to us at the registered office address above.

2. Scope of this policy

This policy covers personal data we process about:

• —

  visitors to the Site;

• —

  people who contact us or request information from us;

• —

  prospective clients we identify and reach out to as part of business development;

• —

  clients and their staff, in connection with delivering our services; and

• —

  suppliers, partners and other business contacts.

This policy does not cover third-party websites or services that we link to. Please review the privacy notices of those third parties separately.

3. The personal data we collect

Depending on how you interact with us, we may process the following:

• —

  Contact and identity data, such as your name, job title, employer, email address and telephone number.

• —

  Enquiry data, being the content of messages you send us through the Site, by email, or through a booking or scheduling tool.

• —

  Client engagement data, being information we process to scope and deliver services, which may include commercial, sales and revenue information about your business.

• —

  Prospecting data, being business contact details of individuals at organisations we consider a potential fit, gathered from public sources and business data providers.

• —

  Technical and usage data, such as your IP address, browser type, device information, and pages viewed, collected through cookies and similar technologies.

• —

  Marketing data, being your preferences in receiving marketing from us.

We do not intentionally collect special category data through the Site, and we ask that you do not send us sensitive personal information unless we have specifically requested it.

4. How we collect your data

We collect personal data:

• —

  directly from you, when you complete a form, email us, book a meeting, or engage our services;

• —

  automatically, through cookies and similar technologies when you use the Site, as described in our Cookie Policy;

• —

  from third parties and public sources, such as LinkedIn, business data providers and publicly available company information, when we carry out business development.

5. Why we use your data and our lawful basis

Under UK GDPR we must have a lawful basis for each purpose for which we use personal data. Our purposes and bases are:

• —

  Responding to enquiries and providing information you request. Lawful basis: our legitimate interests in dealing with enquiries, and, where relevant, taking steps at your request before entering into a contract.

• —

  Delivering our services and managing the client relationship. Lawful basis: performance of a contract, and our legitimate interests in running our business.

• —

  Business development and outbound contact with prospective clients. Lawful basis: our legitimate interests in promoting our services to relevant businesses. Where we contact you in this way, you may object at any time.

• —

  Sending marketing communications. Lawful basis: your consent, or our legitimate interests where we are permitted to contact existing or prospective business contacts about relevant services. You can opt out at any time.

• —

  Analytics and understanding how the Site is used. Lawful basis: your consent, given through our cookie banner.

• —

  Complying with legal and regulatory obligations. Lawful basis: compliance with a legal obligation.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we will provide details of that assessment on request.

6. Who we share your data with

We do not sell your personal data. We share it only where necessary, with:

• —

  Service providers and processors who support our operations, including providers of customer relationship management, email and productivity, website hosting, data storage, analytics, automation, consent management, video conferencing, and business development tooling. Our key providers include HubSpot, Google, Vercel, Supabase, and our consent platform Cookiebot (Usercentrics), among others.

• —

  AI and processing tools, including Anthropic, used to support our work. We do not put client confidential information into public tools without appropriate safeguards and human review.

• —

  Professional advisers, such as accountants and lawyers, where reasonably required.

• —

  Authorities and regulators, where we are required to do so by law.

We put appropriate contractual and security measures in place with the providers who process personal data on our behalf.

7. International transfers

Some of our providers are based outside the United Kingdom, including in the United States and the European Economic Area. Where we transfer personal data outside the United Kingdom, we ensure a similar degree of protection by relying on an appropriate safeguard, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU to US Data Privacy Framework where the recipient is certified.

8. How long we keep your data

We keep personal data only for as long as we need it for the purpose we collected it for, including to meet legal, accounting or reporting requirements. As a general guide:

• —

  enquiry data where no engagement follows: retained for up to 24 months after your last contact with us, unless you ask us to delete it sooner;

• —

  client engagement data: retained for the duration of the engagement and for up to 6 years afterwards, to meet contractual, tax and legal requirements;

• —

  marketing data: retained until you withdraw consent or object;

• —

  technical and analytics data: retained in line with the settings of the relevant provider.

These periods are typical and may vary where a longer or shorter period is appropriate.

9. Your rights

Under data protection law you have the right to:

• —

  request access to the personal data we hold about you;

• —

  request correction of inaccurate or incomplete data;

• —

  request erasure of your data in certain circumstances;

• —

  request restriction of processing in certain circumstances;

• —

  object to processing that relies on our legitimate interests, including for direct marketing;

• —

  request the transfer of your data to you or another party in certain circumstances; and

• —

  withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us at info@trinityhawk.com. We will respond within the time limits set by law. There is normally no charge.

10. Cookies

We use cookies and similar technologies on the Site. Details of the cookies we use, and how you can manage your choices, are set out in our Cookie Policy.

11. Data security

We have put in place appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration and disclosure. We limit access to your data to those who have a business need to have it. We also have procedures to deal with any suspected personal data breach, and we will notify you and any applicable regulator where we are legally required to do so.

12. Links to third-party sites

The Site may include links to third-party websites and services. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy practices. Please read the privacy notice of every website you visit.

13. Children

The Site is intended for business users and is not directed at children. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy from time to time. The version that applies is the one published on the Site, with the date shown at the top. Where changes are significant, we will take reasonable steps to bring them to your attention.

15. How to complain

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to a supervisory authority.

In the United Kingdom this is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, ico.org.uk. If you are in Iceland, you may contact the Icelandic Data Protection Authority (Persónuvernd), personuvernd.is.

16. Contact us

For any privacy question, contact us at info@trinityhawk.com or write to TrinityHawk Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.